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DETAILED ACTION 

Response to Amendment 

1 . This action is in response to the request for reconsideration filed November, 18, 2008. 

2. Claims 56-57 were cancelled. Claims 38 and 44 were amended. 

3. Applicant's arguments, with respect to claims 38-39, and 41-55, have been considered 
but they are not persuasive. 



Examiner Notes 

4. Examiner cites particular columns and line numbers in the references as applied to the 
claims below for the convenience of the applicant. Although the specified citations are 
representative of the teachings in the art and are applied to the specific limitations within the 
individual claim, other passages and figures may apply as well. It is respectfully requested that, 
in preparing responses, the applicant fully consider the references in entirety as potentially 
teaching all or part of the claimed invention, as well as the context of the passage as taught by 
the prior art or disclosed by the examiner. 

Claim Rejections - 35 USC §101 

5. 35 U.S.C. 101 reads as follows: 



Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 
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6. Claims 38-55 are rejected under 35 U.S.C. 101 based on Supreme Court precedent and 
recent Federal Circuit decisions, a 35 U.S.C § 101 process must (1) be tied to a particular 
machine or (2) transform underlying subject matter (such as an article or materials) to a different 
state or thing. In re Bilski et al, 88 USPQ 2d 1385 CAFC (2008); Diamond v. Diehr, 450 U.S. 
175, 184 (1981); Parker v. Flook, 437 U.S. 584, 588 n.9 (1978); Gottschalk v. Benson, 409 U.S. 
63, 70 (1972); Cochrane v. Deener, 94 U.S. 780,787-88 (1876). 

An example of a method claim that would not qualify as a statutory process would be a 
claim that recited purely mental steps. Thus, to qualify as a § 101 statutory process, the claim 
should positively recite the particular machine to which it is tied, for example by identifying the 
apparatus that accomplishes the method steps, or positively recite the subject matter that is being 
transformed, for example by identifying the material that is being changed to a different state. 

The mere recitation of the machine in the preamble with an absence of a machine in the 
body of the claim fails to make the claim statutory under 35 USC 101. Note the Board of Patent 
Appeals Informative Opinion Ex parte Langemyer et al. 

Here, applicant's method steps are not tied to a particular machine and do not perform a 
transformation. Thus, the claims are non-statutory. 

Claim Rejections - 35 USC §103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

a. A patent may not be obtained though the invention is not identically disclosed or described as set forth 

in section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 
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8. Claims 38-39, and claims 42 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Holtzman et al. (US Patent No. 6400272) (hereinafter Holtzman) in view of Scheidt et al. 
(US Pre-Grant Publication No. 20020184509) (hereinafter Scheidt). 

As per claim 38, Holtzman teaches an identification method, comprising: scanning a user 
to read N Radio Frequency Identification (RFID) tags respectively embedded in N objects being 
carried by the user {column 3, lines 8-12; Figure 7, step 321; column 12, lines 5-10; lines 64-67; 
column 13, lines 1-5, a user wishing to gain access to a resource, would present a tag embedded 
in an object to an RFID reader), each tag of the N tags comprising a tag identifier of said each 
tag (column 3, lines 6-7, the reader would scan the tag for the corresponding tag identifier): 
comparing the N tags (column 5, lines 3-14, a database is then consulted to compare the tag 
read by the RFID reader with the tag in a record in determining if the user is permitted access to 
the resource) read by the RFID reader with M tags in a registered record of data, comprising a 
reference to the user, each tag of the M tags comprising a tag identifier (column 5, lines 45-46, 
53-54, a record in this database is essentially the same as the registered record, as a database 
record features the same information: access criterion and any other information relating to the 
identifier, including the name of the user); and permitting access by the user to a resource if said 
comparing has determined that the tag identifiers in the M tags comprise the tag identifiers in the 
N tags read by the RFID reader (column 5, lines 6-14). Holtzman does not specifically teach the 
method of permitting access by a user to a resource if the N tags presented by the user is a subset 
of M tags in the record, where said M being at least N (N being at least 2) . 

However, Scheidt teaches an invention where a user is permitted access to a resource 
based on a combination of RFID tokens (paragraph [0013], lines 1-10). 
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It would have been obvious to one of ordinary skill in the art at the time of the invention 
to modify the teachings of Holtzman to include access criteria in which a user is permitted access 
if the user is in possession of a plurality of tags which correspond to the record of Scheidt 
because it would provide a stronger user identification process than relying on one tag to permit 
access to a resource, as indicated by Scheidt (paragraph [032], lines 8-10). 

It should be noted that it is well known in the art that for possession based security 
systems, access criteria generally comprises of the identifiers for the objects (tag identifiers of 
the M tags) which must be in the possession of a user seeking access to a resource (see Holtzman 
column 10, lines 8-11). 

As per claim 39, Holtzman and Scheidt teach the method of claim 38 as applied above. 
As stated earlier, Scheidt teaches using a combination of RFID tokens to authenticate a user 
requesting access to a resource. Merriam-Webster defines a combination as "any subset of a set 
considered without regard to order within the subset." As such, Scheidt teaches access criteria 
comprising subsets of any size, including all M elements of a set of size M, or any subset thereof. 
In this case, the presence of all of the tags in the registered record is necessary to permit access 
(M = N) . 

As per claim 42, Holtzman and Scheidt teach the method of claim 38, but do not 
specifically teach providing a checksum mechanism for combining identification information in 
the N tag identifiers . 

However, Scheidt further teaches combining identification information from a 
combination of user-provided factors (which may comprise token-based data) into one value, 
termed the Profile Key Encryption Key (PKEK). The process by which this value is generated is 
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repeatable, and Scheidt teaches that there should be a way of verifying the integrity of the value 
upon regeneration (paragraph [0033]). 

It would have been obvious to one of ordinary skill in the art at the time of the invention 
to combine the teachings of Holtzman further with that of Scheidt in order to provide a checksum 
mechanism for combining identification information in the N tag identifiers. One would have 
been motivated to do so as this would increase efficiency of the scanning and comparing means 
while also decreasing the likelihood of errors. 

It should be noted that it is well known in the art that such a verification method could be 
done using a checksum mechanism. 

9. Claims 40-41 are rejected under 35 U.S.C. 103(a) as being unpatentable over Holtzman 
in view of Scheidt, and further in view of Honarvar et al. (hereinafter Honarvar) (US Pre-Grant 
Publication No. 2003/0154406). 

10. As per claim 40, Holtzman and Scheidt teach the method of claim 38 as applied above. 
The references do not specifically teach the method wherein M exceeds N . 

However, Honarvar teaches a method of authenticating users whereby a service/resource 
provider which utilizes knowledge-based authentication is able to set total the number of 
questions to be asked in an authentication session (N). Additionally, this number can be smaller 
than the total number of questions (M). Hence, Honarvar teaches a method wherein the total 
number of possible access criteria is larger than the actual access criteria used in authentication 
at a particular time (paragraph [01 72]). While Honarvar does not explicitly teach possession 
based authentication with the use of tags, it is clear that the use of possession based factors can 
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be substituted and/or supplemented by the use of knowledge based factors in similar ways 
without changing the function of the identification method as claimed while yielding predictable 
results. In this manner, user authentication functions by comparison means of user input (either 
data entered which represents user knowledge, or data read from user possession) against access 
criterion, and whereby successful comparison results in the authentication of a user. 

It would have been obvious for one of ordinary skill in the art at the time of the invention 
to combine the teachings of Holtzman and Scheldt with that of Honarvar in order to utilize a 
smaller subset of tags (in a possession-based authentication) than the total registered set of tags. 
One would have been motivated to do so in order to allow variability in access criteria used for 
authentication (paragraph [0172]). 

As per claim 41, Holtzman, Scheidt, and Honarvar teach the method of claim 40 above. 
Additionally, Honarvar teaches the method wherein prior to scanning the method further 
comprises randomly selecting the N tags from the M tags (paragraph [0182], the service 
provider of a resource can choose for a subset of knowledge-based factors, such as questions, to 
be presented to the user in a random manner by automatically choosing from among "active" 
questions). As such, randomization of access criteria would therefore mean that the subset of tags 
in the record would comprise of a random selection of the M tags in the registered record. 

1 1 . Claim 43 is rejected under 35 U.S.C. 103(a) as being unpatentable over Holtzman in view 
of Scheidt and further in view of Frieden et al. (US Pre-Grant Publication No. 2003/0163446) 
(hereinafter Frieden). 
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As per claim 43, Holtzman and Scheidt teaches the method of claim 38, but does not 
specifically teach sorting the tag identifiers in the N tags read by the RFID reader after scanning . 

However, the concept and advantages to sort multiple elements which may comprise a 
database record is well known and expected in the art. For instance, Frieden teaches sorting a set 
of children within a single record (paragraph [0002]). 

It would have been obvious to one of ordinary skill in the art to modify the invention as 
taught by Holtzman in view of Scheidt to sort the tag identifiers after scanning in order to 
increase the efficiency by which the tags in the possession of the user would be compared against 
the registered record of tags which comprise the access criteria. 

12. Claims 44, and 50-55 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Holtzman in view of Scheidt, and further in view of Nerlikar (US Patent No. 5629981). 

As per claim 44, Holtzman teaches and Scheidt teach the method of claim 38 as applied 

above. 

Neither Holtzman nor Scheidt explicitly teach a method for permitting access to a 
resource other than a computer resource . 

However, Nerlikar teaches a method for controlling access to terminal devices, facilities, 
and other resources (column 6, lines 16-19, 42-47; column 14, lines 32-34) using RFID badges in 
order to provide an "automatic transaction control/monitoring method for transmitting, under 
variable and high levels of security, high- value business, personal or Federal/military 
information, on a real or near real-time basis (column 1, lines 6-11)". Such resources may 
include printers, copiers, pagers, computers, facsimile machines, work stations, video, 
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telephones, VCR, radio, and electronic door mechanisms. It is clear that printers, telephones, 
VCR, and radio comprise of resources other than computer resources. 

It should be noted that it is well known in the art at the time of the invention to use RFID 
technology in authentication systems for providing access by a user to resources comprising of 
both computer and non-computer related resources. Hence, it would have been obvious to one of 
ordinary skill in the art at the time of the invention to modify the invention as taught by 
Holtzman and Scheidt, to control access to non-computer related resources similar to those 
taught by Nerlikar with no change in the respective function of the invention, while also yielding 
predictable results. Substituting the invention to provide access for a resource other than the 
computer should not change the function of the invention, as the reader is typically provided at 
the point of access to a resource (Nerlikar, column 4, lines 32-34), and the system would operate 
in the same manner, regardless of what resource is being guarded. 

As per claim 50, Holtzman further teaches a method wherein a tag identifier in a first tag 
of the N tags includes an indication of a type of the object in which the first tag is embedded 
(column 5, lines 15-16, the tag identifier can be based on the identity of the token, which is an 
object that houses the RFID tag). 

As per claim 51, Holtzman further teaches an invention wherein the reference to the user 
includes the tag identifier comprised by a first tag of the M tags (column 5, lines 6-10, the 
registered record can include additional information pertinent to particular identifiers). It would 
have been obvious to one of ordinary skill in the art at the time of the invention to store in a 
registered record, a reference to the user which includes the tag identifier comprised by a first tag 
of the M tags. Using this tag identifier as part of the reference to the user, the comparing means 
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may easily locate the corresponding access criterion and any other stored information relating to 
the identifier, and take appropriate action (column 5, lines 12-14). 

As per claim 52, Nerlikar further teaches an invention wherein the registered record 
comprises biometric information of the user (column 4, lines 39-41; 49-50, additional 
authentication com/wising biometric information of the user, such as voice signature, retina 
scan, fingerprints, etc.). Therefore, it would have been obvious to one of ordinary skill at the 
time of the invention to modify the teaching of Holtzman with the teaching of Nerlikar to further 
comprise biometric information of the user within the registered record. One would have been 
motivated to do so, as implementing biometric security measures in addition to possession- 
related access control results in the continued protection of a resource from unauthorized access 
should the object used to gain access be stolen and used by someone else. 

As per claim 53, Nerlikar further teaches an invention wherein the M tags have an 
expiration time (column 13, lines 57-67, authorization which features an expiration time). It 
would have been obvious for one of ordinary skill in the art at the time of the invention to 
modify the teaching of Holtzman with the teaching of Nerlikar to set an expiration time for the 
M tags of a registered record. This is useful if an individual is working on a project for a specific 
period of time, as the individual's authorization to access a resource such as a location can be 
automatically cancelled upon the completion of the project (column 13, lines 57-67). 

As per claim 54, Holtzman further teaches a method wherein an object of the N objects 
comprises a watch or a phone (column 3, lines 8-12, a commonplace article). It is well known in 
the art that watches and phones are commonplace articles that may easily incorporate RFID tags. 
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As per claim 55, Holtzman further teaches a method wherein a first tag of the N tags is a 
transponder comprising a microchip with a memory capacity for holding the tag identifier of the 
first tag, and wherein the transponder is adapted to be energized by an external source provided 
by the RFID reader (column 3, lines 13-22). It is well-known in the art that there are RFID tags 
which are passive and which use the excitation signal of the reader as a source of power (column 
3, lines 16-17). In addition, it is also well-known for RFID tags to store data such that a 
particular tag may be uniquely identified by a reader (column 3, lines 19-21). 

13. Claim 45 is rejected under 35 U.S.C. 103(a) as being unpatentable over Holtzman in view 
of Scheidt and further in view of Nerlikar, and further in view of Laval (US Patent No. 61 73209) 
(hereinafter Laval) and further in view of Ott (US Pre-Grant Publication No. US 2003/0052539). 

Holtzman further teaches an invention through which RFID tags are used to identify 
users and allow access to resources (column 12, lines 57-58). One particular resource which the 
user may access with his or her token includes access to credit (column 13, lines 34-36). 

While Holtzman, Scheidt and Nerlikar do not specifically disclose access to the resource 
selected from the group consisting of access to a car and access to a concert , access to these 
resources have been taught in other references. 

Laval, teaches a method for determining access to an attraction, which is defined to 
comprise a location at which a service is provided, including a stage or other show. A customer 
wishing to gain access to an attraction would have been given a pass which is read by a validator 
(column 7, lines 62-66), which then communicates with a database containing information 
regarding the customer to determine his or her access rights to a particular attraction (column 8, 
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lines 7-10). The pass may constitute coded tokens featuring RFID tags (column 8, lines 13-16; 
lines 25-28). 

It would have been obvious to one of ordinary skill in the art at the time of the invention 
that access to an attraction constitutes access to a concert, as the RFID tag embedded in the pass 
is used as a ticket. In addition, it is clear that modifying the invention as taught by the references 
to further comprise access to a concert would yield predictable results without changing the 
function of the identification method as claimed. One would have been motivated to do so in 
order to expand the utility of the invention as taught by Holtzman in view of Scheidt and 
Nerlikar to comprise a comprehensive access control security system which protects a multitude 
of resources. 

Furthermore, Ott teaches an identification system comprising of a reader (paragraph 
[0014], lines 1-3), an RFID tag embedded in some object (paragraph [0015]), and some type of 
comparison means (paragraph [0016]), which determines whether or not a user is authorized to 
access a resource such as a car (paragraph [0025]). It would have been obvious to one of 
ordinary skill in the art at the time of the invention to modify the teachings of Holtzman, Scheidt, 
and Nerlikar to further comprise access to a car. Doing so would result in an invention taught by 
the references which performs inherently the same function with predictable results, in which N 
tags carried by the user are scanned and compared against a registered record of data to permit 
access to a resource such as a car. One would be motivated to modify the invention as taught by 
Holtzman in view of Scheidt and Nerlikar for the reasons stated above. 

Ott states that "the identification system can, of course, also be used with other objects in 
which access is possible only after confirmation of authorization, for example with a computer, a 
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telephone, an ATM, a building, garage or other regions which are initially barred (paragraph 
[0036], lines 4-8)." Therefore, it would have been obvious to one of ordinary skill in the art at 
the time of the invention that combining all the references above in order to provide access to 
additional resources as noted by Ott, could be achieved without a change in the function of the 
invention as taught, also yielding predictable results. 

14. Claims 46-47 are rejected under 35 U.S.C. 103(a) as being unpatentable over Holtzman 
in view of Scheidt and further in view of Ncrlikar, and further in view of Byford (US Patent No. 
6581161). 

As per claims 46-47, Holtzman, Scheidt, and Nerlikar teach the method of claim 44 as 
applied above, but do not specifically teach the method of authenticating the user during a 
registration process in which the registered record is generated . 

However, Byford teaches that a system for controlling access would feature secure 
verification means for verifying the user's identity in addition to having an encryption means for 
encrypting communications between a portable apparatus, a server means, and access control 
means (column 2, lines 45-49; lines 64-67). 

It would have been obvious to one of ordinary skill in the art at the time of the invention 
to combine the teachings of Holtzman, Scheidt, and Nerlikar further with Byford, to authenticate 
the user during a registration process in which the registered record (comprising access criteria 
for the user) is generated, and further to encrypt the communication between all elements during 
this registration process to prevent unauthorized users from being able to access the registered 
record. One would be motivated to do so as a user would additionally have a means to delete 
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access criteria after use (Byford, column 2, lines 40-42). In doing so, it would be important to 
verify the identity of the user before allowing him or her to change access criteria in any manner. 

In addition, it is well known in the art that public key encryption is a commonly used 
encryption method. Therefore, it would have been obvious to one of ordinary skill in the art at 
the time of the invention to utilize an asymmetric key pair, and wherein the key pair consists of a 
private key and a public key for the authentication of the user during the registration process. 

15. Claims 48-49 are rejected under 35 U.S.C. 103(a) as being unpatentable over Holtzman 
in view of Scheidt and further in view of Ncrlikar, and further in view of Byford, and further in 
view of Honarvar. 

As per claim 48, Holtzman, Scheidt, and Nerlikar teach the method of claim 47 as applied 
above. The references do not specifically teach the method wherein prior to said scanning the 
method further comprises generating a digital certificate having data therein, and wherein the 
data in the digital certificate comprises a name of the user and the identifiers in the M tags. 

However, Honarvar teaches generating rules (composed of access criteria) (paragraph 
[0111]), by associating one or more fields from a data source (paragraph [0030]), such as a 
digital certificate (which may have been internally generated) (paragraph [0112]), prior to the 
authentication process (i.e., scanning and comparing of user input versus rules). It is implicit that 
in the case of possession-based authentication, such an internally generated digital certificate 
would need to comprise pertinent information for authentication including the name of the user 
and the tag identifiers (paragraph [0118]). 
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It would have been obvious to one of ordinary skill in the art at the time of the invention 
to combine the teachings of Holtzman, Scheidt, and Nerlikar with that of Honarvar to generate a 
digital certificate containing user authentication data, prior to scanning. One would have been 
motivated to do so in order to dynamically control a data sources (paragraph [0029]) from 
which access criteria/rules for authentication are generated at a later time. 

As per claim 49, it was well known in the art at the time of the invention for a portion of 
the data (digital signature) in the digital certificate to be encrypted with the private key and be 
accessed with the public key . Microsoft Computer Dictionary (fifth edition; 2002; page 158) 
provides the following definition of a digital certificate: 

A user identity card or "driver's license" for cyberspace. Issued by a certificate authority fCA), a digital certificate is 
an electronic credential that authenticates a user on the Internet and intranets. Digital certificates ensure the 
legitimate online transfer of confidential information, money, or other sensitive materials by means of public 
encryption technology. A digital certificate holder has two keys (strings of numbers): a private key held only by the 
user, for "signing" outgoing messages mid decrypting incoming messages; and a public hey, for use by anyone, for 
encrypting data to send to a specific user 

Therefore, it would have been obvious to one of ordinary skill in the art at the time of the 
invention to encrypt a portion of the data in a digital certificate with a private key, which may 
then be accessed by another using the corresponding public key. One would have been motivated 
to do so in order to authenticate the user by using digital certificates during a registration 
process. 



Response to Arguments 
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16. Applicant's arguments, see page 10, and respective amendments filed November 18, 
2008, with respect to the objection to the oath have been fully considered and are persuasive. 
The objection of oath has been withdrawn. 

17. Applicant's arguments, see page 10, and respective amendments filed November 18, 
2008, with respect to the objections to the specification have been fully considered and are 
persuasive. The objections to the specification have been withdrawn. 

18. Applicant's arguments, see page 10, and respective amendments filed November 18, 
2008, with respect to the objection to claim 38 have been fully considered and are persuasive. 
The objection of claim 38 has been withdrawn. 

19. As per claims 38-39 and 41-55, Applicant's arguments filed November 18, 2008 have 
been fully considered but they are not persuasive. 

As per claim 38, in the remarks applicant argues that "Scheidt does not disclose more 
than one RFID token for permitting access to a system" (page 14). 

In response to applicant's arguments, applicant is directed to Scheidt (paragraph [0066]), 
whereby the reference teaches using two or more tokens for permitting access to a system. 

As per claim 39, in the remarks applicant argues that there is "no disclosure in Scheidt 
that the totality of such tokens identified in a record of data (M) is equal to the number of objects 
carried by the user (N)" (page 15). 

In response to applicant's arguments, Scheidt implicitly teaches the feature "wherein 
M=N," as the reference teaches multi-factor authentication and that any combination of user 
credentials can be used for authentication. 
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As per claim 42, in the remarks applicant argues that there is no prior art identified that 
discloses the use of a checksum for any purpose. Additionally, applicant argues that "the well- 
known use of a checksum mechanism is quite different than use of 'a checksum mechanism for 
combining identification information in the N tag identifiers' as required by the preceding 
feature of claim 42" (pages 17-18). 

In response to applicant's arguments, absent any specific features, checksum is a generic 
method of verifying if the data has been tampered. The specification does not disclose any 
specific features with regards to this "checksum mechanism." As such, Scheidt teaches the 
feature of a "checksum mechanism for combining identification information in the N tag 
identifiers" as disclosed above. 

20. As per claim 44, Applicant's arguments fail to comply with 37 CFR 1 .1 1 1(b) because 
they amount to a general allegation that the claims define a patentable invention without 
specifically pointing out how the language of the claims patentably distinguishes them from the 
references. 

21 . As per claims 45-49, Applicant's arguments do not comply with 37 CFR 1 . 1 1 1(c) because 
they do not clearly point out the patentable novelty which he or she thinks the claims present in 
view of the state of the art disclosed by the references cited or the objections made. Further, they 
do not show how the amendments avoid such references or objections. 

22. As per claims 40-41, Applicant's arguments, see pages 13-15, filed November 18, 2008, 
with respect to the rejection of claim 40 under 103(a) have been fully considered and are 
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persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, 
a new ground of rejection is made in view of Holtzman, in view of Scheidt, and further in view 
of Honarvar. The new ground of rejection is also applied to claim 41, which is dependent from 
claim 40. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to VIRGINIA HO whose telephone number is 571-270-7309. The 
examiner can normally be reached on Mon to Thu; 7:30 AM - 5:00 PM (Eastern). 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



V.H. 



/VIRGINIA HO/ 
Examiner, Art Unit 2432 
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/Benjamin E Lanier/ 

Primary Examiner, Art Unit 2432 



